feat(lab9): falco custom rules + conftest hardening policies

[karmihkr]

Goal

Run Falco with modern eBPF to detect baseline and custom runtime alerts, then write Conftest/Rego policies to gate Kubernetes manifests at CI time.

Changes

• Custom Falco rules: "Write to /tmp by container" + "Possible Cryptominer Activity" (labs/lab9/falco/rules/custom-rules.yaml)
• Conftest hardening policies for K8s Deployments (labs/lab9/policies/extra/hardening.rego)

Testing

docker run -d --name falco --privileged ... falcosecurity/falco:0.43.1 falco -U -o json_output=true

2 baseline alerts confirmed: Terminal shell in container, Read sensitive file untrusted
Custom rule fired on: echo test > /tmp/my-write.txt
Cryptominer rule fired on: nc -w 2 127.0.0.1 3333

conftest test labs/lab9/manifests/k8s/juice-hardened.yaml --policy labs/lab9/policies/extra/     # 10 tests, 0 failures
conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml --policy labs/lab9/policies/extra/   # 5 failures as expected
conftest test labs/lab9/manifests/compose/juice-compose.yml --policy labs/lab9/policies/compose-security.rego --namespace compose.security   # 0 failures

Full output and analysis in submissions/lab9.md.

Artifacts & Screenshots

• submissions/lab9.md
• labs/lab9/falco/rules/custom-rules.yaml
• labs/lab9/policies/extra/hardening.rego

Checklist

• Title is clear (feat(labN): <topic> style)
• No secrets/large temp files committed
• Submission file at submissions/lab9.md exists